Change a product
Partner key + restaurant key. The fields from creation plus isAvailable (sold out), isActive and imageUrl (an image from the LettBestilt image library or uploaded to LettBestilt, or null); left out = unchanged, at least one field. variants and allergens are replaced as a set when sent (an empty list removes all); with variants and without basePrice the base price becomes the default size’s. Send the ids from GET to keep the rows: a row with id is updated in place, a row without id is new (new id), and rows that are left out are deleted. New ids can make orders fail for up to six minutes, because the website shows the cached menu. Size prices (tierPrices) cannot be set through the API: a new addon in a group with sizes costs the same for all sizes (unless a deleted addon with the same name had prices), and a new size without addonTierKey gives the addons their base price. notice says so. imageIsStock (the website must then label the image «Illustrasjonsfoto») changes only when imageUrl changes. Through LettBestilt MCP a size is never deleted: if variants lacks a size that exists (also when it is sent without id, as a new one), the response is 422 VALIDATION_FAILED with the path variants and the names, and nothing is changed. New sizes and changes with id are allowed. A person removes sizes in the restaurant dashboard or with the partner API directly. Optimistic concurrency: GET (and every write response) has version, a hash of the row and its sizes (product) or its sizes and addons (addon group). Send it back as expectedVersion: if anything changed since you read it, nothing is written and the response is 409 CHANGED; read it again and retry. Without expectedVersion the write is only conditional on the row as it was read inside the request, so a change made after your GET is overwritten. Always send it when you work from an earlier read (an AI tool working from an old get_menu). expectedUpdatedAt is rejected with 422. A price above 0 and below 500 øre (5 kr) is saved, but gives a warning in warnings ([{ path, message }]): it looks like kroner (149 for 149 kr). Names and descriptions are trimmed and cleaned (links, email addresses, HTML, javascript: and invisible direction marks are removed); the count is in textCleaned, and a name that ends up empty gives 422. GET /api/v1/menu is CDN-cached (s-maxage=30, stale-while-revalidate=300, at most 330 seconds), so the website can show the old menu for up to six minutes; the response has notice about it.
Authentication
The partner key (lbp_test_… or lbp_live_…), sent as Authorization: Bearer lbp_… and created in LettBestilt Partner under Partner key. It belongs to the whole partner, not to a restaurant, and only works against /api/v1/partner. Server to server only: a request with an Origin header is rejected with 403 FORBIDDEN, and the key must never be in a browser. A TEST key sees and creates only sandboxes; LIVE keys work once LettBestilt Partner is open. A suspended or archived partner, a revoked key and a restaurant key (lbs_…) here give 401 UNAUTHORIZED; an expired key gives 401 KEY_EXPIRED.
The restaurant’s own key (lbs_test_… or lbs_live_…) for calls about one restaurant in the partner API, sent together with the partner key. The key must have full access (scope *, otherwise 403 INSUFFICIENT_SCOPE), belong to a restaurant the partner owns and be in the same environment as the partner key. A restaurant that does not exist, belongs to another partner or does not match the key always gives the same 404 RESTAURANT_NOT_FOUND. Older keys without an environment in the prefix (lbs_<random>) are not accepted here; rotate them in LettBestilt Partner.
Path parameters
The restaurant’s slug. It must match the restaurant key in X-LettBestilt-Restaurant-Key.
The product’s id from GET …/menus/{menuId}.
Request
In øre. Required without variants; with sizes it defaults to the default size’s price.
The sizes, at most 8, in order (unique names, case-insensitive). Replaced as a set when changing. Send the ids from GET to keep the rows: a row with id is updated in place, a row without id is new (new id), and rows that are left out are deleted. New ids can make orders fail for up to six minutes, because the website shows the cached menu.
Allergen codes from the catalogue (as in the menu proposal). Replaced as a set when changing.
PICKUP = pickup only, DELIVERY = delivery only, null = both. Enforced by POST /api/v1/orders (422 FULFILLMENT_NOT_ALLOWED).
false = hidden from the menu. Default true.
false = sold out (shown, but cannot be ordered). Default true.
An https URL that is either an active image from the LettBestilt image library or a file uploaded to LettBestilt (UploadThing), the unchanged current image, or null to remove it; any other URL (also a retired library image) gives 422. imageIsStock changes only when the image changes: the image library gives true, an own image and null false.
Optional: version from GET. 409 CHANGED when the row changed since then.

